SwiftyEdit CMS Cross-Site Request Forgery Vulnerability

SwiftyEdit CMS is an open source content management platform. A cross-site request forgery vulnerability exists in versions of SwiftyEdit CMS prior to v1.2.0, which stems from vulnerability to cross-site request forgery CSRF attacks...

CVE-2023-47350

Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...

CVE-2023-48701

Statamic CMS (Laravel/Git) suffers a Cross-site Scripting (XSS) via uploaded assets vulnerability (CVE-2023-48701). Before versions 3.4.15 and 4.36.0, HTML files crafted to look like images could be uploaded regardless of MIME validation via front-end Forms assets fields or the authenticated cont...

CVE-2023-48649

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name...

PortlandLabs Concrete CMS Security Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A security vulnerability exists in PortlandLabs Concrete CMS prior to 8.5.13 and versions prior to 9.2.2, which stems from a File creation function that may grant too many permissions when...

FreeBSD : typo3 -- Multiple vulnerabilities (7cc003cb-83b9-11ee-957d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7cc003cb-83b9-11ee-957d-b42e991fc52e advisory. - TYPO3 is an open source PHP based web content management system released under the GNU GPL. ...

The vulnerability of the check_privacy_settings function in the WordPress plugin’s GDPR content management system allows a hacker to execute XSS attacks.

The vulnerability of the checkprivacysettings function in the WordPress plugin and the WordPress content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks remotely...

CVE-2023-47127

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...

CVE-2023-47126

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...

CVE-2023-47125

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versio...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...

CVE-2023-47125 By-passing Cross-Site Scripting Protection in HTML Sanitizer

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versio...

CVE-2023-47125 By-passing Cross-Site Scripting Protection in HTML Sanitizer

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versio...

CVE-2023-47126 Information Disclosure in Install Tool in typo3/cms-install

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...

CVE-2023-47126

TYPO3 information-disclosure CVE-2023-47126: In affected TYPO3 versions, the login screen of the standalone install tool reveals the full path to the transient data directory (e.g., /var/www/html/var/transient/) for composer-based installations; classic non-composer installations are not affected...

CVE-2023-47126 Information Disclosure in Install Tool in typo3/cms-install

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...

CVE-2023-47127 Weak Authentication in Session Handling in typo3/cms-core

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...

CVE-2023-47127

TYPO3 core vulnerability CVE-2023-47127: in installations with multiple sites, a session cookie from one site can be reused on another without re-authentication. Affects TYPO3 CMS core; remediation is to upgrade to fixed versions (8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8). The connected advisorie...

The vulnerability of the installModule component in the Wonder CMS content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the installModule component in the Wonder CMS content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...